Hacker News Reader

Comment by fictioncircle | Hacker News Reader

If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)

View on HN

Relevant: https://en.wikipedia.org/wiki/Underhanded_C_Contest

Valid point.

https://github.com/HainaLi/horcrux_password_manager

It is in JS at least. Underhanded C is likely an easier trick to manage.

True, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling.

Make sure you read the code of the compiler you're using as well, and bootstrap/compile it from that source instead of trusting an existing compiler binary.

Why stop with compilers? Inspect the circuit diagrams for all your hardware and then make sure the actual manufacturing followed the designs to a tee.

I mean I know it hyperbole but I am pretty sure there are hardware bugs that allow access, see that Intel or IBM remote management disclosure. It might not a real backdoor but it's as good as one. As people above are mentioning keep your paranoia inside your threat model

I wish I could find the story where someone actually had this issue.

Basically, the story was that a program for grad research was inserting all kinds of nasty, anti-semetic things into text and it turned out the previous grad student had poisoned the compiler which was modifying the strings and was able to re-poison it every time through something else.

I forgot the exact details but it is an amazing read.

If you're able to find that, I'd love to read it.

Found it

https://www.quora.com/What-is-a-coders-worst-nightmare/answe...

Was a great read -- thanks!

> True, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling.

Then they aren't paranoid but normal folks, eh?

What do you mean by "treat it as code you authored"?

For purposes of security paranoia, if you can perform a security audit on open source code it is just as good as any other code you've written.

Idk about other people but I find anything I don't find security holes in myself "as good" as anything I've written. I've got the same set of assumptions/blinders/competence either way.

Reply on news.ycombinator.com